Privacy Policy
Your privacy is important to us.
We take the protection of your personal data very seriously. We treat your personal data confidentially and following the legal rules of the relevant data protection laws, particularly the European General Data Protection Regulation (GDPR) and this privacy policy.
This privacy policy covers the use of our digital content, including our social media profiles, via PC, smartphones, tablets, and all other internet-enabled mobile devices.
The digital content may contain links to other websites of third-party service providers to which this data protection declaration does not apply.
Controller / Responsible party
The controller / responsible party for processing your personal data is
Katulu GmbH
An der Alster 6
20099 Hamburg
hello@katulu.io.
If you have any questions regarding data protection at our company, please write to us at the postal address above, with the subject of “Data Protection” or at the provided e-mail address.
Purpose of Personal Data Processing
Data Processing for the Provision of Contractual Services
You can send us inquiries about commissioning contractual services via our website and the contact details stored there. Provided that personal data is transmitted to us by you in this way or by other means when inquiring about commissions, we process your data to answer your inquiries, for the execution of the order/contract as well as for invoicing. For this, we require your (company) name, your address data, as well as your e-mail address. Without this data, we cannot execute the contract with you. Additionally, we collect further data within the scope of the contract initiation or contract execution, which is not absolutely necessary for the contract execution, but which serves the purpose and is beneficial for it.
In the case of suppliers/service providers, we process the personal data provided by them this way or in another manner for the purpose of ordering and commissioning services on our part, as well as to pay for the services provided. For this, we require the name, address data, and account data. Depending on the service/contract, we may also require additional data, which we will then inform you about on a case-by-case basis. If you provide further data, we will also use this for the aforementioned purposes, but such data is not required for the conclusion of the contract.
The legal basis for data processing is Art. 6 (1) p. 1 lit. b GDPR, which permits the processing of data for the fulfillment of a contract or pre-contractual measures.
Data Processing for Communication with You
In addition to the contractual data, we process the communication data provided by you (names of contact persons, telephone number, fax number, e-mail address) to contact and communicate with you. Personal data that you provide to us by e-mail, post, or telephone will only be processed for correspondence with you or only for the purpose for which you provided us with the data.
The basis for data processing is Art. 6 (1) p. 1 lit. b GDPR, which permits the processing of data for the fulfillment of a contract or pre-contractual measures
Cookies
We do not set any cookies ourselves. According to Arcade, the embedded product demo of Arcade does not store any cookies either with the settings we have chosen (see "Use of Arcade").
We do not use preferences cookies, statistics cookies and marketing cookies on any of our web pages to recognize and track you if you visit our website again, and/or to adapt our services to your personal preferences among other things.
Preferences cookies allow a website to remember choices you have made in the past, like what language you prefer. Statistics cookies collect information about how you use a website, like which pages you visited and which links you clicked on. Their only purpose is to improve website functions. Marketing cookies track your online activity to help advertisers deliver more relevant advertising. These cookies can share that information with other organizations. These cookies are persistent cookies and usually set by a third-party.
Cookies are small text files that are stored on a visitor’s computer and contain data about the respective user to provide access to various functions. A session cookie is temporarily stored on the computer you are using while you navigate through the website. A session cookie is deleted as soon as you close your Internet browser or as soon as your session has expired after a certain period.
Most browsers accept cookies automatically – so if you wish to suppress the use of cookies, you may need to actively delete or block cookies, or prevent the storage of cookies through a setting in your browser software. Please note, however, that if you refuse the use of cookies, you may continue to visit our website, but some features may be impaired in their operation.
We may work with third parties on some of our websites, which means that when you visit such a website, cookies from partner companies may also be stored on your hard drive (third-party cookies). However we select our partners carefully. We provide the information below about the use of such cookies and similar technologies (e.g. storage in your browser) and the scope of the data collected in each case, in particular under "Use of Arcade".
Insofar as we use cookies that are required to enable the provision of the services owed by us or to ensure the functionality of our services, the data processing in this regard is carried out based on Art. 6 (1) p. 1 lit. b GDPR, which permits the processing of data for the fulfillment of a contract or pre-contractual measures, or according to Art. 6 (1) p. 1 lit. f GDPR, which permits data processing to protect the legitimate interests of the controller, unless the interests or the fundamental rights and freedoms of the data subject outweigh the interest of the controller in the data processing. Our interest then lies in ensuring the functionality of our website.
For the use of other, non-essential cookies, we may obtain your consent. The data processing is then based on your consent according to Art. 6 (1) p. 1 lit. a GDPR. You can revoke or change your consent at any time. The legality of the data processing already performed remains unaffected by the revocation.
Hosting by Amazon Web Services (AWS)
This website is hosted by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg ("AWS"). The files of our website are stored in the storage service Amazon S3 in the AWS region Europe (Frankfurt) and are delivered to your browser via the content delivery network Amazon CloudFront. AWS is our hosting provider and receives the data described below. The AWS GDPR Data Processing Addendum (Art. 28 GDPR) is part of our contract with AWS. The basis for the data processing is Art. 6 (1) p. 1 lit. f GDPR, which permits data processing to protect the legitimate interests of the controller. Our interest lies in a secure, fast and reliable provision of our website.
When you visit our website, your browser automatically transmits technical data to the CloudFront server that answers the request, in particular your IP address and the other data listed under "Log Files" below. AWS processes this data to deliver our website to you and, for its own purposes, to ensure the security and stability of its service (e.g. protection against DDoS attacks). We have not activated the access logging of Amazon CloudFront, so we do not store server log files. The hosting itself does not set any cookies.
Amazon CloudFront answers requests from servers (edge locations) close to you. We use a CloudFront price class that serves requests primarily from edge locations in North America (USA, Canada and Mexico), Europe (including Türkiye) and Israel; AWS may occasionally serve requests from other locations. Your data may therefore also be processed outside the European Union and the European Economic Area, in particular in the USA, for example when you visit our website from outside Europe. Amazon Web Services, Inc. is certified under the EU-U.S. Data Privacy Framework (as part of the certification of Amazon.com, Inc.), for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). For other countries, the transfer is based on an adequacy decision of the European Commission where one exists (e.g. for Israel and Canada), and otherwise on the EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR), which are incorporated into the AWS GDPR Data Processing Addendum.
For more information, please refer to the Privacy Notice, the GDPR Center and the GDPR Data Processing Addendum of Amazon Web Services accordingly at https://aws.amazon.com/privacy/ and at https://aws.amazon.com/compliance/gdpr-center/ and at https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf .
Use of Umami
This website uses the web analytics service Umami of the software company Umami Software Inc., 1362 42nd Ave, San Francisco, CA 94122, USA ("Umami") on the basis of the website operator’s legitimate interests (Section 6 paragraph 1 lit.f GDPR) in order to collect and save data on usage evaluation and optimisation purposes.
In order to do this, a javascript based code, which serves to capture data according to website usage. The service only captures encrypted data using a non-retrievable one-way function. The data is pseudonymised and is not used to identify website visitors personally. No data is captured that allows Umami or us to identify website visitors personally.
Umami stores this information in a pseudonymized user profile. The information is neither used by Umami nor by us to identify individual users nor is it merged with other data about individual users.
The data stored by Umami will be deleted as soon as they are no longer required for their intended purpose and there are no legal obligations to retain them. Umami does not store any cookies on your terminal device.
For more information, please refer to the Terms of Use and Privacy Policy of Umami Software Inc. accordingly at https://umami.is/terms and at https://umami.is/privacy .
Use of Arcade
This website uses the product demo service Arcade of the software company Arcade Software Inc., 445 Bush Street, Suite 400, San Francisco, CA 94108, USA ("Arcade") on the basis of the website operator’s legitimate interests (Section 6 paragraph 1 lit.f GDPR) in order to provide interactive product demos.
In order to do this, the demo is embedded via an iframe on our home page and on our platform page. The iframe is loaded automatically, without a click, as soon as you scroll close to the demo. Your browser then connects directly to the servers of Arcade and of the service providers used by Arcade to deliver the demo, in particular its hosting and content delivery providers Vercel (Vercel Inc., USA) and Cloudflare (Cloudflare, Inc., USA) and the video service Mux (Mux, Inc., USA), and loads Arcade's own scripts. To deliver the demo and its video to you, Arcade and these service providers necessarily process your IP address and technical information about your browser and device. We have configured the iframe so that the address of the page on which you view the demo is not transmitted to Arcade (no referrer). According to its privacy policy, Arcade may also use the IP address to determine the organisation from which the demo is viewed (e.g. company name and industry) and acts as an independent controller for this. Arcade's video player may also send technical statistics about the playback of the video to Mux's video analytics service Mux Data. A list of the service providers used by Arcade is available at https://www.arcade.software/subprocessors .
The data stored by Arcade will be deleted as soon as they are no longer required for their intended purpose and there are no legal obligations to retain them.
We have enabled Arcade's privacy settings "Do Not Track" (tracking disabled), "Disable IP tracking" and "Disable error reporting" for our demos. According to Arcade, with these settings Arcade does not store any cookies or local storage entries on your device, no data about your interaction with the demo (such as clicks and views) is sent to Arcade, IP addresses are not tracked, and errors that occur in the demo are not reported. Our website does not send Arcade a consent signal that would switch tracking back on.
Arcade and the service providers it uses process your data in the USA. For such transfers, Arcade relies on the EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR) according to its privacy policy.
For more information, please refer to the Terms of Use, Privacy Policy and GDPR Requirements of Arcade Software Inc. accordingly at https://www.arcade.software/terms-of-service and at https://www.arcade.software/privacy and at https://docs.arcade.software/kb/admin/general-security/gdpr-requirements .
Links to Third-Party Websites and Services
Our website contains plain links to services of other providers, for example to share an article or to download a document. No content, scripts or cookies of these providers are loaded when you visit our website.
Only when you click such a link does your browser open the website of the respective provider and transmit your IP address, the data your browser usually sends and, at most, the address of our website without the specific page (referrer). From then on, the respective provider is responsible for the processing of your data in accordance with its own privacy policy.
Social networks: our articles contain a "Share" link to LinkedIn, and our pages link to our company profiles on LinkedIn and X and to the LinkedIn profiles of our team members. These are plain links, not social plugins. The providers are LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, and X Internet Unlimited Company, Dublin, Ireland. When you click such a link, LinkedIn or X receives the address of the page you share or open and can assign your visit to your user account if you are logged in. For more information, please refer to the privacy policies of LinkedIn and X accordingly at https://www.linkedin.com/legal/privacy-policy and at https://x.com/en/privacy .
Downloads: the "Download" buttons for our whitepaper on our solution pages lead to Google Drive, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). When you click such a button, Google processes your data; if you are logged in to your Google account, Google can assign the access to it. Google may also process data in the USA. For more information, please refer to the Privacy Policy of Google at https://policies.google.com/privacy .
E-mail: our contact buttons are e-mail links (mailto) that open your own e-mail program. No data is transmitted to us until you send an e-mail. We process your e-mail as described under "Data Processing for Communication with You".
Data Processing to Protect Legitimate Interests
We also process your data if it is necessary to protect legitimate interests of ours or of third parties. This may be the case, in particular, to ensure IT security and IT operations, especially in the case of support requests, to be able to trace and prove facts in the event of legal disputes, for market and opinion surveys, to statistically evaluate the use of our website, for advertising other products from us or our cooperation partners.
The basis for the data processing is Art. 6 (1) p. 1 lit. f GDPR. We have a legitimate interest in the data processing listed above. Our interest is optionally in IT security, in ensuring support for better usability of our website or in our legal interest or in our evaluation and advertising interest.
Data Processing for Advertising Purposes
We use the data you provide to send you recommendations and information about our products and services by mail.
Additionally, we use your e-mail address to send you information about our company’s products and services by e-mail if you have already purchased products or services from us. You will receive these recommendations from us regardless of whether you have subscribed to a newsletter. We want to send you information in this way about similar products and services from our range that might interest you based on your most recent purchases/orders from us. We strictly comply with the legal requirements in this regard.
If you no longer wish to receive recommendations on products or services or to receive advertising from us in general, you can revoke your consent at any time. A notification in text form to the contact data mentioned under point 1 (e.g. e-mail, fax, letter) is sufficient for this purpose.
The basis for data processing is Art. 6 (1) p. 1 lit. f GDPR, which permits the processing of data to protect the legitimate interests of the controller, provided that the interests or fundamental rights and freedoms of the data subject are not overridden. Our interest is commercial and lies in the promotion and sale of our products and services.
Log Files
Each time our websites are accessed, usage data is transmitted by the respective Internet browser to our hosting provider (see "Hosting by Amazon Web Services (AWS)" above). This usage data contains the following data: Date and time of access, name of the page accessed, IP address, referrer URL (origin URL from which you came to the web pages), the amount of data transferred, as well as product and version information of the browser used and the operating system of your PC. The data is processed only to deliver our website and to ensure its security. We have not activated server log files (the access logging of Amazon CloudFront), so these data records are not stored by us. We do not evaluate this hosting data in any other way (for the statistical evaluation of the use of our website, see "Use of Umami"). Neither any personal “surfing profiles” nor the like are created or processed.
The basis for data processing is Art. 6 (1) p. 1 lit. f GDPR, which permits the processing of data to protect the legitimate interests of the controller, provided that the interests or fundamental rights and freedoms of the data subject are not overridden. We have an interest in the secure and reliable delivery of our website and in the prevention of unlawful use of our offer.
Data Processing for the Fulfillment of Legal Obligations
Furthermore, we process your data for the fulfillment of legal obligations (e.g. regulatory requirements, commercial and tax law retention, and verification obligations).
The basis for the data processing is Art. 6 (1) p. 1 lit. c GDPR, which permits the processing for the fulfillment of a legal obligation.
Categories of Recipients of Personal Data
Your personal data will only be disclosed or otherwise transferred to third parties if this is necessary for the purpose of contract processing or billing, or if you have previously consented, or if there is a legal basis for the disclosure.
Your contractual and communication data will be forwarded to the responsible office and the responsible employees within our company in each case to answer your inquiries, for communication or for the execution of the order, or for the fulfillment of contractual obligations. The basis for this is again Art. 6 (1) p. 1 lit. b GDPR, which permits the processing of data for the fulfillment of a contract or pre-contractual measures.
If it is necessary for the purpose of contract processing or for the provision of our services, data is forwarded to partner companies that have been commissioned to support contract processing. Our partners are obliged to comply with and observe the provisions of data protection law. Our partners are not permitted to use the data for any other purpose than the processing of the contract. The basis for this is Art. 6 (1) p. 1 lit. b GDPR, which permits the processing of data for the fulfillment of a contract or pre-contractual measures.
Your personal data will otherwise only be disclosed or transferred to third parties outside our company if this is necessary for the purpose of contract processing or billing, or if you have given your prior consent, or if there is a legal basis for the disclosure.
Whenever we use the services of third parties for the execution and handling of processing operations, we will comply with the provisions of the General Data Protection Regulation. Service providers that support us in providing our service to you are hosting providers, email service providers, IT service providers, software (SaaS) providers.
Period of Data Storage
In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes unless temporary storage is still necessary. For example, we store your data based on legal obligations to provide proof and to retain data, which result, among other things, from the German Commercial Code and the German Fiscal Code. The storage periods are then up to ten full years. Additionally, we retain your data for the period during which claims can be asserted against our company (statutory limitation period of three or up to thirty years).
Data Security
Your personal data is transmitted securely on our website using encryption. We use the encryption protocol TLS (Transport Layer Security) for secure data transmission on the Internet. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line. Furthermore, we secure our websites and other systems by technical and organizational measures against loss, destruction, access, modification, or distribution of your data by unauthorized persons. Our security measures are continuously improved in line with technological developments. However, we would like to point out that data transmission on the Internet may have security gaps and cannot be completely protected against access by third parties, which applies in particular and especially when communicating by e-mail. We are therefore happy to offer you the option of using S/MIME encryption and signing for e-mail communication; please feel free to contact us in this regard.
Data Subject Rights
Within the framework of the applicable legal provisions, you have the right at any time to receive information free of charge about your personal data stored by us, its origin and recipients, and the purpose of data processing and, if applicable, the right to have this data corrected or deleted. To this end, as well as for further questions on the subject of personal data, you can contact us at any time using the contact details listed in section 1. You may also be entitled to a right to restrict the processing of your data and a right to receive the data you have provided in a structured, common, and machine-readable format. If you have given us consent to process personal data for specific purposes, you may revoke your consent at any time with effect for the future. If we process your data to protect legitimate interests, you may object to this processing on grounds relating to your particular situation. Additionally, you have the option of contacting a data protection supervisory authority (Right of Complaint).